Black October cybersecurity: AI threats and PHP fixes

On October 21, 2026, the PHP development team pushed an emergency patch for two critical vulnerabilities, now known as PHP2Shell. Rated 9.2 on the CVSS scale, these flaws allow unauthenticated attackers to execute code remotely. CISA added them to its Known Exploited Vulnerabilities catalog just five days later.

Security researchers quickly dubbed the month's surge in incidents the Black October cybersecurity wave. The sheer volume of issues—Microsoft alone issued over 1,400 security patches this month, according to Krebs on Security—shows how fragile our web infrastructure remains.

We are also seeing artificial intelligence play a massive role on both sides. Researchers using OpenAI models and Google's Wiz discovered the PHP2Shell flaws. Meanwhile, Microsoft reports that a state-aligned threat actor used an AI penetration testing framework called ARTEX to breach cloud infrastructure in under three hours. You can read more about AI agents software development security in Black October to see how this changes the threat model.

The attacks didn't stop at language-level vulnerabilities. On the exact same day the PHP patches dropped, the release infrastructure for LiteLLM—a popular open-source gateway for large language models—was compromised. Attackers distributed a malicious version (1.107.0) through PyPI and Docker registries.

If you pulled that version, you brought credential-stealing and remote-access software straight into your environment. We also saw a maximum-severity vulnerability in GitLab that allowed remote system control, plus an incident where weak private keys from Indian digital trust provider eMudhra forced emergency responses from Google Chrome and Mozilla Firefox.

The lesson here is that attackers are moving upstream. They want to compromise the tools we use to build and deploy software, bypassing perimeter defenses entirely.

You need to audit your dependencies right now. If you run PHP, update your servers immediately to patch the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). If you use LiteLLM, verify your installed versions and rotate any credentials that might have been exposed to version 1.107.0.

When rotating exposed API keys, use a secure password generator rather than relying on weak human-created strings. If you need to inspect suspicious encoded payloads found in your logs during an incident response, you can decode Base64 in the browser to quickly see what the attackers were trying to execute.

The speed of automated attacks means we can no longer wait weeks to apply patches. Update your systems, check your dependencies, and assume your software supply chain is under active scrutiny.